A fake job interview, a coding test and $11.8 million gone. In Singapore, scammers used LinkedIn and Google Meet to compromise a developer's work computer. Their real target was not his personal wallet, but the systems of the company that employed him. The attack did not exploit any flaws in a blockchain. Hackers stole a Bitbucket session token, modified the company's software deployment chain and then bypassed its internal controls to transfer crypto.
A pseudo-recruiter crossed on LinkedIn stole $11.8 million in cryptocurrencies via a technical test containing an information thief
The operating mode corresponds to the “Contagious Interview” campaign documented since the end of 2023 (BeaverTail, InvisibleFerret, malicious npm packages)
These operations are attributed to groups linked to North Korea, credited with more than $2 billion in crypto thefts over the year 2025
No protocol flaw is involved: isolated virtual machine and hardware crypto wallet are sufficient to neutralize this attack vector
LinkedIn, Google Meet and a fake technical test
The Straits Times tells us how it all started. And it is a message sent on LinkedIn in which the scammer presents himself as a recruiter for a company linked to cryptocurrencies. He then continues the exchanges by email, from a domain name imitating that of a legitimate company.
And the staging doesn’t stop there. The victim participates in several interviews on Google Meet, but his interlocutor systematically keeps his camera turned off. She then receives a link to a fake site on which she must perform a programming test.
The developer then uses his professional computer and unknowingly downloads malware that does not directly empty the wallet extensions and does not recover the recovery phrase. No, he steals his Bitbucket session token.
This file allows attackers to resume an already authenticated session without triggering a new multi-factor validation request. They thus access the account linked to the company's code repository.
From code deposit to stolen crypto transfers
And bingo! Once inside Bitbucket, hackers modify the company's automated software deployment instructions. This manipulation then gives them remote access to internal servers, where they retrieve new identifiers.
The attack then progresses to financial systems. Scammers manage to bypass transaction limits and approval procedures before making cryptocurrency transfers. The damage reached 11.8 million US dollars, or approximately 15.1 million Singapore dollars.
The Singapore Police Force and the national cybersecurity agency recommend verifying each recruiter through official company channels and refusing any downloads from an unknown site. Finally, they also advise never running a technical test on a professional machine connected to internal systems.
Companies also need to protect their API keys, strengthen multi-factor authentication, monitor their code repositories, and compartmentalize their deployment procedures. If in doubt, they should immediately isolate the device, revoke all active sessions, change credentials, and check access logs.
